<feed xmlns='http://www.w3.org/2005/Atom'>
<title>src/sys/netipsec/ipsec_input.c, branch releng/14.2</title>
<subtitle>FreeBSD source tree</subtitle>
<link rel='alternate' type='text/html' href='http://cgit.freebsd.org/src/'/>
<entry>
<title>sys: Remove $FreeBSD$: one-line .c pattern</title>
<updated>2023-08-16T17:54:36+00:00</updated>
<author>
<name>Warner Losh</name>
<email>imp@FreeBSD.org</email>
</author>
<published>2023-08-16T17:54:36+00:00</published>
<link rel='alternate' type='text/html' href='http://cgit.freebsd.org/src/commit/?id=685dc743dc3b5645e34836464128e1c0558b404b'/>
<id>685dc743dc3b5645e34836464128e1c0558b404b</id>
<content type='text'>
Remove /^[\s*]*__FBSDID\("\$FreeBSD\$"\);?\s*\n/
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Remove /^[\s*]*__FBSDID\("\$FreeBSD\$"\);?\s*\n/
</pre>
</div>
</content>
</entry>
<entry>
<title>IfAPI: Explicitly include &lt;net/if_private.h&gt; in netstack</title>
<updated>2023-01-31T20:02:16+00:00</updated>
<author>
<name>Justin Hibbits</name>
<email>jhibbits@FreeBSD.org</email>
</author>
<published>2023-01-23T15:05:29+00:00</published>
<link rel='alternate' type='text/html' href='http://cgit.freebsd.org/src/commit/?id=3d0d5b21c9b2cfd7e48209340a090f63ca4bce03'/>
<id>3d0d5b21c9b2cfd7e48209340a090f63ca4bce03</id>
<content type='text'>
Summary:
In preparation of making if_t completely opaque outside of the netstack,
explicitly include the header.  &lt;net/if_var.h&gt; will stop including the
header in the future.

Sponsored by:	Juniper Networks, Inc.
Reviewed by:	glebius, melifaro
Differential Revision: https://reviews.freebsd.org/D38200
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Summary:
In preparation of making if_t completely opaque outside of the netstack,
explicitly include the header.  &lt;net/if_var.h&gt; will stop including the
header in the future.

Sponsored by:	Juniper Networks, Inc.
Reviewed by:	glebius, melifaro
Differential Revision: https://reviews.freebsd.org/D38200
</pre>
</div>
</content>
</entry>
<entry>
<title>tcp: embed inpcb into tcpcb</title>
<updated>2022-12-07T17:00:48+00:00</updated>
<author>
<name>Gleb Smirnoff</name>
<email>glebius@FreeBSD.org</email>
</author>
<published>2022-12-07T17:00:48+00:00</published>
<link rel='alternate' type='text/html' href='http://cgit.freebsd.org/src/commit/?id=e68b3792440cac248347afe08ba5881a00ba6523'/>
<id>e68b3792440cac248347afe08ba5881a00ba6523</id>
<content type='text'>
For the TCP protocol inpcb storage specify allocation size that would
provide space to most of the data a TCP connection needs, embedding
into struct tcpcb several structures, that previously were allocated
separately.

The most import one is the inpcb itself.  With embedding we can provide
strong guarantee that with a valid TCP inpcb the tcpcb is always valid
and vice versa.  Also we reduce number of allocs/frees per connection.
The embedded inpcb is placed in the beginning of the struct tcpcb,
since in_pcballoc() requires that.  However, later we may want to move
it around for cache line efficiency, and this can be done with a little
effort.  The new intotcpcb() macro is ready for such move.

The congestion algorithm data, the TCP timers and osd(9) data are
also embedded into tcpcb, and temprorary struct tcpcb_mem goes away.
There was no extra allocation here, but we went through extra pointer
every time we accessed this data.

One interesting side effect is that now TCP data is allocated from
SMR-protected zone.  Potentially this allows the TCP stacks or other
TCP related modules to utilize that for their own synchronization.

Large part of the change was done with sed script:

s/tp-&gt;ccv-&gt;/tp-&gt;t_ccv./g
s/tp-&gt;ccv/\&amp;tp-&gt;t_ccv/g
s/tp-&gt;cc_algo/tp-&gt;t_cc/g
s/tp-&gt;t_timers-&gt;tt_/tp-&gt;tt_/g
s/CCV\(ccv, osd\)/\&amp;CCV(ccv, t_osd)/g

Dependency side effect is that code that needs to know struct tcpcb
should also know struct inpcb, that added several &lt;netinet/in_pcb.h&gt;.

Differential revision:	https://reviews.freebsd.org/D37127
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
For the TCP protocol inpcb storage specify allocation size that would
provide space to most of the data a TCP connection needs, embedding
into struct tcpcb several structures, that previously were allocated
separately.

The most import one is the inpcb itself.  With embedding we can provide
strong guarantee that with a valid TCP inpcb the tcpcb is always valid
and vice versa.  Also we reduce number of allocs/frees per connection.
The embedded inpcb is placed in the beginning of the struct tcpcb,
since in_pcballoc() requires that.  However, later we may want to move
it around for cache line efficiency, and this can be done with a little
effort.  The new intotcpcb() macro is ready for such move.

The congestion algorithm data, the TCP timers and osd(9) data are
also embedded into tcpcb, and temprorary struct tcpcb_mem goes away.
There was no extra allocation here, but we went through extra pointer
every time we accessed this data.

One interesting side effect is that now TCP data is allocated from
SMR-protected zone.  Potentially this allows the TCP stacks or other
TCP related modules to utilize that for their own synchronization.

Large part of the change was done with sed script:

s/tp-&gt;ccv-&gt;/tp-&gt;t_ccv./g
s/tp-&gt;ccv/\&amp;tp-&gt;t_ccv/g
s/tp-&gt;cc_algo/tp-&gt;t_cc/g
s/tp-&gt;t_timers-&gt;tt_/tp-&gt;tt_/g
s/CCV\(ccv, osd\)/\&amp;CCV(ccv, t_osd)/g

Dependency side effect is that code that needs to know struct tcpcb
should also know struct inpcb, that added several &lt;netinet/in_pcb.h&gt;.

Differential revision:	https://reviews.freebsd.org/D37127
</pre>
</div>
</content>
</entry>
<entry>
<title>netinet*: remove PRC_ constants and streamline ICMP processing</title>
<updated>2022-10-04T03:53:04+00:00</updated>
<author>
<name>Gleb Smirnoff</name>
<email>glebius@FreeBSD.org</email>
</author>
<published>2022-10-04T03:53:04+00:00</published>
<link rel='alternate' type='text/html' href='http://cgit.freebsd.org/src/commit/?id=fcb3f813f379f544f9cd2a10d18045588da0e132'/>
<id>fcb3f813f379f544f9cd2a10d18045588da0e132</id>
<content type='text'>
In the original design of the network stack from the protocol control
input method pr_ctlinput was used notify the protocols about two very
different kinds of events: internal system events and receival of an
ICMP messages from outside.  These events were coded with PRC_ codes.
Today these methods are removed from the protosw(9) and are isolated
to IPv4 and IPv6 stacks and are called only from icmp*_input().  The
PRC_ codes now just create a shim layer between ICMP codes and errors
or actions taken by protocols.

- Change ipproto_ctlinput_t to pass just pointer to ICMP header.  This
  allows protocols to not deduct it from the internal IP header.
- Change ip6proto_ctlinput_t to pass just struct ip6ctlparam pointer.
  It has all the information needed to the protocols.  In the structure,
  change ip6c_finaldst fields to sockaddr_in6.  The reason is that
  icmp6_input() already has this address wrapped in sockaddr, and the
  protocols want this address as sockaddr.
- For UDP tunneling control input, as well as for IPSEC control input,
  change the prototypes to accept a transparent union of either ICMP
  header pointer or struct ip6ctlparam pointer.
- In icmp_input() and icmp6_input() do only validation of ICMP header and
  count bad packets.  The translation of ICMP codes to errors/actions is
  done by protocols.
- Provide icmp_errmap() and icmp6_errmap() as substitute to inetctlerrmap,
  inet6ctlerrmap arrays.
- In protocol ctlinput methods either trust what icmp_errmap() recommend,
  or do our own logic based on the ICMP header.

Differential revision:	https://reviews.freebsd.org/D36731
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
In the original design of the network stack from the protocol control
input method pr_ctlinput was used notify the protocols about two very
different kinds of events: internal system events and receival of an
ICMP messages from outside.  These events were coded with PRC_ codes.
Today these methods are removed from the protosw(9) and are isolated
to IPv4 and IPv6 stacks and are called only from icmp*_input().  The
PRC_ codes now just create a shim layer between ICMP codes and errors
or actions taken by protocols.

- Change ipproto_ctlinput_t to pass just pointer to ICMP header.  This
  allows protocols to not deduct it from the internal IP header.
- Change ip6proto_ctlinput_t to pass just struct ip6ctlparam pointer.
  It has all the information needed to the protocols.  In the structure,
  change ip6c_finaldst fields to sockaddr_in6.  The reason is that
  icmp6_input() already has this address wrapped in sockaddr, and the
  protocols want this address as sockaddr.
- For UDP tunneling control input, as well as for IPSEC control input,
  change the prototypes to accept a transparent union of either ICMP
  header pointer or struct ip6ctlparam pointer.
- In icmp_input() and icmp6_input() do only validation of ICMP header and
  count bad packets.  The translation of ICMP codes to errors/actions is
  done by protocols.
- Provide icmp_errmap() and icmp6_errmap() as substitute to inetctlerrmap,
  inet6ctlerrmap arrays.
- In protocol ctlinput methods either trust what icmp_errmap() recommend,
  or do our own logic based on the ICMP header.

Differential revision:	https://reviews.freebsd.org/D36731
</pre>
</div>
</content>
</entry>
<entry>
<title>netipsec: move specific ipsecmethods declarations to ipsec_support.h</title>
<updated>2022-10-04T03:53:04+00:00</updated>
<author>
<name>Gleb Smirnoff</name>
<email>glebius@FreeBSD.org</email>
</author>
<published>2022-10-04T03:53:04+00:00</published>
<link rel='alternate' type='text/html' href='http://cgit.freebsd.org/src/commit/?id=809fef2913574cb37d2dadc00abfd62619d52040'/>
<id>809fef2913574cb37d2dadc00abfd62619d52040</id>
<content type='text'>
where struct ipsec_methods is defined.  Not a functional change.
Allows further modification of method prototypes without breaking
compilation of other ipsec compilation units.

Differential revision:	https://reviews.freebsd.org/D36730
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
where struct ipsec_methods is defined.  Not a functional change.
Allows further modification of method prototypes without breaking
compilation of other ipsec compilation units.

Differential revision:	https://reviews.freebsd.org/D36730
</pre>
</div>
</content>
</entry>
<entry>
<title>netinet6: retire ip6protosw.h</title>
<updated>2022-10-04T03:53:04+00:00</updated>
<author>
<name>Gleb Smirnoff</name>
<email>glebius@FreeBSD.org</email>
</author>
<published>2022-10-04T03:53:04+00:00</published>
<link rel='alternate' type='text/html' href='http://cgit.freebsd.org/src/commit/?id=46ddeb6be8e839d4e404c98c230fe1b57a9ea32f'/>
<id>46ddeb6be8e839d4e404c98c230fe1b57a9ea32f</id>
<content type='text'>
The netinet/ipprotosw.h and netinet6/ip6protosw.h were KAME relics, with
the former removed in f0ffb944d25 in 2001 and the latter survived until
today.  It has been reduced down to only one useful declaration that
moves to ip6_var.h

Reviewed by:		melifaro
Differential revision:	https://reviews.freebsd.org/D36726
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
The netinet/ipprotosw.h and netinet6/ip6protosw.h were KAME relics, with
the former removed in f0ffb944d25 in 2001 and the latter survived until
today.  It has been reduced down to only one useful declaration that
moves to ip6_var.h

Reviewed by:		melifaro
Differential revision:	https://reviews.freebsd.org/D36726
</pre>
</div>
</content>
</entry>
<entry>
<title>protosw: separate pr_input and pr_ctlinput out of protosw</title>
<updated>2022-08-17T18:50:31+00:00</updated>
<author>
<name>Gleb Smirnoff</name>
<email>glebius@FreeBSD.org</email>
</author>
<published>2022-08-17T18:50:31+00:00</published>
<link rel='alternate' type='text/html' href='http://cgit.freebsd.org/src/commit/?id=78b1fc05b20504ed13aeeb4a5b47443246cabaeb'/>
<id>78b1fc05b20504ed13aeeb4a5b47443246cabaeb</id>
<content type='text'>
The protosw KPI historically has implemented two quite orthogonal
things: protocols that implement a certain kind of socket, and
protocols that are IPv4/IPv6 protocol.  These two things do not
make one-to-one correspondence. The pr_input and pr_ctlinput methods
were utilized only in IP protocols.  This strange duality required
IP protocols that doesn't have a socket to declare protosw, e.g.
carp(4).  On the other hand developers of socket protocols thought
that they need to define pr_input/pr_ctlinput always, which lead to
strange dead code, e.g. div_input() or sdp_ctlinput().

With this change pr_input and pr_ctlinput as part of protosw disappear
and IPv4/IPv6 get their private single level protocol switch table
ip_protox[] and ip6_protox[] respectively, pointing at array of
ipproto_input_t functions.  The pr_ctlinput that was used for
control input coming from the network (ICMP, ICMPv6) is now represented
by ip_ctlprotox[] and ip6_ctlprotox[].

ipproto_register() becomes the only official way to register in the
table.  Those protocols that were always static and unlikely anybody
is interested in making them loadable, are now registered by ip_init(),
ip6_init().  An IP protocol that considers itself unloadable shall
register itself within its own private SYSINIT().

Reviewed by:		tuexen, melifaro
Differential revision:	https://reviews.freebsd.org/D36157
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
The protosw KPI historically has implemented two quite orthogonal
things: protocols that implement a certain kind of socket, and
protocols that are IPv4/IPv6 protocol.  These two things do not
make one-to-one correspondence. The pr_input and pr_ctlinput methods
were utilized only in IP protocols.  This strange duality required
IP protocols that doesn't have a socket to declare protosw, e.g.
carp(4).  On the other hand developers of socket protocols thought
that they need to define pr_input/pr_ctlinput always, which lead to
strange dead code, e.g. div_input() or sdp_ctlinput().

With this change pr_input and pr_ctlinput as part of protosw disappear
and IPv4/IPv6 get their private single level protocol switch table
ip_protox[] and ip6_protox[] respectively, pointing at array of
ipproto_input_t functions.  The pr_ctlinput that was used for
control input coming from the network (ICMP, ICMPv6) is now represented
by ip_ctlprotox[] and ip6_ctlprotox[].

ipproto_register() becomes the only official way to register in the
table.  Those protocols that were always static and unlikely anybody
is interested in making them loadable, are now registered by ip_init(),
ip6_init().  An IP protocol that considers itself unloadable shall
register itself within its own private SYSINIT().

Reviewed by:		tuexen, melifaro
Differential revision:	https://reviews.freebsd.org/D36157
</pre>
</div>
</content>
</entry>
<entry>
<title>ipsec: isolate knowledge about protocols that are last header</title>
<updated>2022-08-17T15:24:28+00:00</updated>
<author>
<name>Gleb Smirnoff</name>
<email>glebius@FreeBSD.org</email>
</author>
<published>2022-08-17T15:24:11+00:00</published>
<link rel='alternate' type='text/html' href='http://cgit.freebsd.org/src/commit/?id=489482e276cf301ba3c47e022a50b0f4f6d2b6f2'/>
<id>489482e276cf301ba3c47e022a50b0f4f6d2b6f2</id>
<content type='text'>
Retire PR_LASTHDR protosw flag.

Reviewed by:		ae
Differential revision:	https://reviews.freebsd.org/D36155
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Retire PR_LASTHDR protosw flag.

Reviewed by:		ae
Differential revision:	https://reviews.freebsd.org/D36155
</pre>
</div>
</content>
</entry>
<entry>
<title>ipsec: Improve validation of PMTU</title>
<updated>2022-07-27T14:12:34+00:00</updated>
<author>
<name>Kornel Dulęba</name>
<email>kd@FreeBSD.org</email>
</author>
<published>2022-07-27T14:12:34+00:00</published>
<link rel='alternate' type='text/html' href='http://cgit.freebsd.org/src/commit/?id=863871d369f8deb687aafa26599d93a6ef7c5e41'/>
<id>863871d369f8deb687aafa26599d93a6ef7c5e41</id>
<content type='text'>
Currently there is no upper bound on the PMTU value that is accepted.
Update hostcache only if the new pmtu is smaller than the current entry
and the link MTU.

Approved by:	mw(mentor)
Sponsored by:	Stormshield
Obtained from:	Semihalf
Differential Revision: https://reviews.freebsd.org/D35872
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
Currently there is no upper bound on the PMTU value that is accepted.
Update hostcache only if the new pmtu is smaller than the current entry
and the link MTU.

Approved by:	mw(mentor)
Sponsored by:	Stormshield
Obtained from:	Semihalf
Differential Revision: https://reviews.freebsd.org/D35872
</pre>
</div>
</content>
</entry>
<entry>
<title>ipsec: enter epoch before calling into ipsec_run_hhooks</title>
<updated>2021-09-21T17:02:41+00:00</updated>
<author>
<name>Mateusz Guzik</name>
<email>mjg@FreeBSD.org</email>
</author>
<published>2021-09-17T12:00:20+00:00</published>
<link rel='alternate' type='text/html' href='http://cgit.freebsd.org/src/commit/?id=590d0715b348d0d8da0c0355cebd9dff18e39831'/>
<id>590d0715b348d0d8da0c0355cebd9dff18e39831</id>
<content type='text'>
pfil_run_hooks which eventually can get called asserts on it.

Reviewed by:	ae
Sponsored by:	Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D32007
</content>
<content type='xhtml'>
<div xmlns='http://www.w3.org/1999/xhtml'>
<pre>
pfil_run_hooks which eventually can get called asserts on it.

Reviewed by:	ae
Sponsored by:	Rubicon Communications, LLC ("Netgate")
Differential Revision: https://reviews.freebsd.org/D32007
</pre>
</div>
</content>
</entry>
</feed>
